CVE-2026-32105

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-32105", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-03-10T22:02:38.854Z", "datePublished": "2026-04-17T19:27:39.809Z", "dateUpdated": "2026-04-20T16:22:50.262Z"}, "containers": {"cna": {"title": "xrdp: RDP MAC signature (dataSignature) never verified on receive \u2014 integrity bypass in non-TLS mode", "problemTypes": [{"descriptions": [{"cweId": "CWE-354", "lang": "en", "description": "CWE-354: Improper Validation of Integrity Check Value", "type": "CWE"}]}], "metrics": [{"cvssV4_0": {"attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "userInteraction": "NONE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "vulnAvailabilityImpact": "LOW", "subConfidentialityImpact": "HIGH", "subIntegrityImpact": "HIGH", "subAvailabilityImpact": "LOW", "baseScore": 9.3, "baseSeverity": "CRITICAL", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:L/SC:H/SI:H/SA:L", "version": "4.0"}}], "references": [{"name": "https://github.com/neutrinolabs/xrdp/security/advisories/GHSA-j2jm-c596-c5q3", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/neutrinolabs/xrdp/security/advisories/GHSA-j2jm-c596-c5q3"}, {"name": "https://github.com/neutrinolabs/xrdp/releases/tag/v0.10.6", "tags": ["x_refsource_MISC"], "url": "https://github.com/neutrinolabs/xrdp/releases/tag/v0.10.6"}], "affected": [{"vendor": "neutrinolabs", "product": "xrdp", "versions": [{"version": "< 0.10.6", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-04-17T19:27:39.809Z"}, "descriptions": [{"lang": "en", "value": "xrdp is an open source RDP server. In versions through 0.10.5, xrdp does not implement verification for the Message Authentication Code (MAC) signature of encrypted RDP packets when using the \"Classic RDP Security\" layer. While the sender correctly generates signatures, the receiving logic lacks the necessary implementation to validate the 8-byte integrity signature, causing it to be silently ignored. An unauthenticated attacker with man-in-the-middle (MITM) capabilities can exploit this missing check to modify encrypted traffic in transit without detection. It does not affect connections where the TLS security layer is enforced. This issue has been fixed in version 0.10.6. If users are unable to immediately upgrade, they should configure xrdp.ini to enforce TLS security (security_layer=tls) to ensure end-to-end integrity."}], "source": {"advisory": "GHSA-j2jm-c596-c5q3", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-04-20T16:22:40.648583Z", "id": "CVE-2026-32105", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-20T16:22:50.262Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-32105", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-04-20T16:22:40.648583Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-20T16:22:45.660Z"}}], "cna": {"title": "xrdp: RDP MAC signature (dataSignature) never verified on receive \u2014 integrity bypass in non-TLS mode", "source": {"advisory": "GHSA-j2jm-c596-c5q3", "discovery": "UNKNOWN"}, "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 9.3, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:L/SC:H/SI:H/SA:L", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "subAvailabilityImpact": "LOW", "vulnAvailabilityImpact": "LOW", "subConfidentialityImpact": "HIGH", "vulnConfidentialityImpact": "NONE"}}], "affected": [{"vendor": "neutrinolabs", "product": "xrdp", "versions": [{"status": "affected", "version": "< 0.10.6"}]}], "references": [{"url": "https://github.com/neutrinolabs/xrdp/security/advisories/GHSA-j2jm-c596-c5q3", "name": "https://github.com/neutrinolabs/xrdp/security/advisories/GHSA-j2jm-c596-c5q3", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/neutrinolabs/xrdp/releases/tag/v0.10.6", "name": "https://github.com/neutrinolabs/xrdp/releases/tag/v0.10.6", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "xrdp is an open source RDP server. In versions through 0.10.5, xrdp does not implement verification for the Message Authentication Code (MAC) signature of encrypted RDP packets when using the \"Classic RDP Security\" layer. While the sender correctly generates signatures, the receiving logic lacks the necessary implementation to validate the 8-byte integrity signature, causing it to be silently ignored. An unauthenticated attacker with man-in-the-middle (MITM) capabilities can exploit this missing check to modify encrypted traffic in transit without detection. It does not affect connections where the TLS security layer is enforced. This issue has been fixed in version 0.10.6. If users are unable to immediately upgrade, they should configure xrdp.ini to enforce TLS security (security_layer=tls) to ensure end-to-end integrity."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-354", "description": "CWE-354: Improper Validation of Integrity Check Value"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-04-17T19:27:39.809Z"}}}, "cveMetadata": {"cveId": "CVE-2026-32105", "state": "PUBLISHED", "dateUpdated": "2026-04-20T16:22:50.262Z", "dateReserved": "2026-03-10T22:02:38.854Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-04-17T19:27:39.809Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "xrdp", "vendor": "neutrinolabs", "versions": [{"status": "affected", "version": "< 0.10.6"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:neutrinolabs:xrdp:*:*:*:*:*:*:*:*", "matchCriteriaId": "BC4D3050-83C5-4368-B1D3-534B28E0917A", "versionEndExcluding": "0.10.6", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "xrdp is an open source RDP server. In versions through 0.10.5, xrdp does not implement verification for the Message Authentication Code (MAC) signature of encrypted RDP packets when using the \"Classic RDP Security\" layer. While the sender correctly generates signatures, the receiving logic lacks the necessary implementation to validate the 8-byte integrity signature, causing it to be silently ignored. An unauthenticated attacker with man-in-the-middle (MITM) capabilities can exploit this missing check to modify encrypted traffic in transit without detection. It does not affect connections where the TLS security layer is enforced. This issue has been fixed in version 0.10.6. If users are unable to immediately upgrade, they should configure xrdp.ini to enforce TLS security (security_layer=tls) to ensure end-to-end integrity."}, {"lang": "es", "value": "xrdp es un servidor RDP de c\u00f3digo abierto. En versiones hasta la 0.10.5, xrdp no implementa la verificaci\u00f3n para la firma del C\u00f3digo de Autenticaci\u00f3n de Mensajes (MAC) de los paquetes RDP cifrados cuando se utiliza la capa de \u2019Seguridad RDP Cl\u00e1sica\u2019. Aunque el remitente genera correctamente las firmas, la l\u00f3gica de recepci\u00f3n carece de la implementaci\u00f3n necesaria para validar la firma de integridad de 8 bytes, lo que provoca que sea ignorada silenciosamente. Un atacante no autenticado con capacidades de man-in-the-middle (MitM) puede explotar esta verificaci\u00f3n faltante para modificar el tr\u00e1fico cifrado en tr\u00e1nsito sin detecci\u00f3n. No afecta a las conexiones donde se aplica la capa de seguridad TLS. Este problema ha sido solucionado en la versi\u00f3n 0.10.6. Si los usuarios no pueden actualizar inmediatamente, deben configurar xrdp.ini para aplicar la seguridad TLS (security_layer=tls) para asegurar la integridad de extremo a extremo."}], "id": "CVE-2026-32105", "lastModified": "2026-10-26T22:10:00.163", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 7.7, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L", "version": "3.1"}, "exploitabilityScore": 2.2, "impactScore": 5.5, "source": "nvd@nist.gov", "type": "Primary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 9.3, "baseSeverity": "CRITICAL", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "LOW", "subConfidentialityImpact": "HIGH", "subIntegrityImpact": "HIGH", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:L/SC:H/SI:H/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "LOW", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-32105", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-04-20T16:22:40.648583Z", "version": "2.0.3"}}]}, "published": "2026-04-17T20:16:33.517", "references": [{"source": "security-advisories@github.com", "tags": ["Patch", "Release Notes"], "url": "https://github.com/neutrinolabs/xrdp/releases/tag/v0.10.6"}, {"source": "security-advisories@github.com", "tags": ["Vendor Advisory"], "url": "https://github.com/neutrinolabs/xrdp/security/advisories/GHSA-j2jm-c596-c5q3"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-354"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{"bugzilla": {"description": "xrdp: xrdp: Data integrity compromised due to missing MAC signature verification in Classic RDP Security", "id": "2459272", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2459272"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.9", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N", "status": "draft"}, "cwe": "CWE-347", "details": ["A flaw was found in xrdp, an open-source Remote Desktop Protocol (RDP) server. When using the \"Classic RDP Security\" layer, xrdp fails to verify the Message Authentication Code (MAC) signature of encrypted RDP packets. This oversight allows an unauthenticated attacker with man-in-the-middle (MITM) capabilities to modify encrypted traffic as it travels between the client and server without being detected, compromising data integrity. This vulnerability does not affect connections where the Transport Layer Security (TLS) security layer is enforced."], "mitigation": {"lang": "en:us", "value": "Configure xrdp to enforce TLS security. Edit `/etc/xrdp/xrdp.ini` and set `security_layer=tls` in the `[Globals]` section. A restart of the xrdp service is required for the changes to take effect."}, "name": "CVE-2026-32105", "public_date": "2026-04-17T19:27:39Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-32105\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-32105\nhttps://github.com/neutrinolabs/xrdp/releases/tag/v0.10.6\nhttps://github.com/neutrinolabs/xrdp/security/advisories/GHSA-j2jm-c596-c5q3"], "statement": "This vulnerability in xrdp compromises data integrity when the \"Classic RDP Security\" layer is in use, allowing an unauthenticated man-in-the-middle attacker to modify encrypted RDP traffic without detection. Connections configured to enforce the TLS security layer are not affected by this flaw.\nThis vulnerability doesn't affect any supported Red Hat products.", "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,0.10.6)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "xrdp", "source": "cna", "vendor": "neutrinolabs"}, "product": "xrdp", "vendor": "neutrinolabs"}], "analysis": {"en": {"generated_at": "2026-04-18T17:09:13.805721+00:00", "value": {"mitigation_remediation": ["Upgrade neutrinolabs xrdp to version 0.10.6 or later. ", "Configure the server to use TLS by setting security_layer=tls in xrdp.ini when an upgrade cannot be performed immediately. ", "Ensure all RDP clients connect using TLS or disable the Classic RDP Security layer on the server."], "summary": {"action": "Apply Patch", "impact": "Integrity bypass allowing traffic tampering in non-TLS RDP sessions"}, "threat_synthesis": {"affected_systems": "The flaw impacts the neutrinolabs xrdp product for all releases up to and including version 0.10.5. The offending code was addressed in version 0.10.6, making that and later releases immune to the issue.", "description_and_impact": "The vulnerability arises because xrdp fails to verify the Message Authentication Code (MAC) signature that is inserted into encrypted RDP packets when the \"Classic RDP Security\" layer is used. The sender correctly generates an 8\u2011byte integrity signature, but the receiver never checks it, causing any modifications to the packet contents to be silently accepted. An attacker who can observe the connection\u2014such as through a man\u2011in\u2011the\u2011middle position\u2014could therefore alter traffic without detection, potentially affecting session data, user credentials, or other sensitive information. This flaw does not affect connections that use the TLS security layer, where integrity is already protected.", "risk_and_exploitability": "With a CVSS score of 9.3 the vulnerability is rated critical. The EPSS score is not available, but the lack of a publicly listed KEV entry does not diminish the risk. An exploit requires the attacker to be able to intercept RDP traffic while the server is using Classic RDP Security, a common scenario on networks that permit RDP or in environments that have not mandated TLS. If these conditions exist, exploitation is straightforward and can occur without authentication. The potential impact is high because traffic can be modified undetected."}}}}, "created": "2026-04-17T20:30:15.692154+00:00", "updated": "2026-04-18T17:15:05.782153+00:00", "vendors": ["neutrinolabs", "neutrinolabs$PRODUCT$xrdp"]}